fix: updated packages to resolve cves

[lucaseduoli]

This pull request updates the docs/package-lock.json file with several dependency upgrades, removals, and configuration changes. The most significant changes include updating multiple package versions (notably ajv, brace-expansion, joi, and others), removing deprecated dependencies, and adding the "peer": true flag to many packages to clarify their peer dependency status. Additionally, new dependencies were added, and some nested dependencies were updated for compatibility.

Dependency Updates and Upgrades:

• Upgraded ajv from version 6.15.0 to 8.20.0, updating its dependencies and adding the "peer": true flag. Also updated json-schema-traverse from 0.4.1 to 1.0.0, and upgraded brace-expansion from 1.1.15 to 5.0.7 [1] [2] [3].
• Upgraded joi from 17.13.3 to 17.13.4 and updated related dependencies.
• Upgraded http-proxy-middleware from 2.0.9 to 2.0.10 and js-yaml (used by gray-matter) from 3.14.2 to 3.15.0 [1] [2].

Dependency Removals and Additions:

• Removed the deprecated concat-map dependency, which is no longer required by the updated brace-expansion package.
• Added the new fast-uri dependency (v3.1.3) and its funding information.

Peer Dependency Configuration:

• Added "peer": true to a large number of packages throughout the lockfile, clarifying their intended usage as peer dependencies (e.g., @babel/core, @algolia/client-search, @docusaurus/plugin-content-docs, acorn, postcss-selector-parser, and many more) [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] etc.).

Nested Dependency Updates:

• Added nested dependencies for file-loader and null-loader (e.g., their own versions of ajv and json-schema-traverse), ensuring compatibility for sub-dependencies [1] [2] [3] [4].

These changes collectively improve dependency management, security, and compatibility for the documentation project.

Summary by CodeRabbit

• Chores
  • Updated several project dependencies and version constraints to keep the app ecosystem current and compatible.
  • Added a new command-line utility dependency for broader tooling support.
  • Refined Python package requirements to include a newer networking/ID handling library version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fe8d4d9c-4a1b-4d7a-9449-566248a5117e

📥 Commits

Reviewing files that changed from the base of the PR and between 1591ee4 and 561e3a7.

⛔ Files ignored due to path filters (4)

• docs/package-lock.json is excluded by !**/package-lock.json
• frontend/package-lock.json is excluded by !**/package-lock.json
• sdks/python/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• docs/package.json
• frontend/package.json
• pyproject.toml
• sdks/python/pyproject.toml

---

Walkthrough

This PR updates dependency override entries in docs/package.json and frontend/package.json (bumping brace-expansion, adding ajv constraints, and new override entries), and adds pinned dependencies (click, idna) to two pyproject.toml files.

Changes

Dependency pins and overrides

Layer / File(s)	Summary
npm overrides update docs/package.json, frontend/package.json	Adds ajv overrides for webpack-dev-server and mini-css-extract-plugin, bumps brace-expansion to 5.0.7, and appends new overrides for shell-quote, http-proxy-middleware, js-yaml, gray-matter, and joi.
Python dependency additions pyproject.toml, sdks/python/pyproject.toml	Adds click>=8.3.3 and idna>=3.15 to project dependency lists.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• langflow-ai/openrag#1750: Both PRs modify docs/package.json's overrides section to pin the same transitive packages, notably ajv and brace-expansion.

Suggested reviewers: Wallgau

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency updates made to address CVEs and compatibility issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/upgrade_cve_versions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft

[mfortman11]

LGTM